60ab676b24c0f3fa0406c991352079e510eaa95b5c848aaebeb2a4d563a5ccb3

Sharing

Copy URL Twitter E-mail

General

Target
60ab676b24c0f3fa0406c991352079e510eaa95b5c848aaebeb2a4d563a5ccb3
Size 530KB
Sample260728-rbae4she98
SHA256 60ab676b24c0f3fa0406c991352079e510eaa95b5c848aaebeb2a4d563a5ccb3
MD5 1282d7d53338c095c9106c1a9dabf7ad
SHA1 47fdf731b7dc7381261d5d64f87e085bb27706ca
SHA512 67a247513c3b6f2dfa83e0fac40d764ffa21fc1149dbea4cce45ec09ff4745226ffa590e662c9bba906a857d6e943785181e60f93624db09a718cbdce395fcc1
SSDEEP 12288:Z5+srJ5yI4IYIII5IqIYIgIHIEIRdI6I6IkrBOpQH+2svfgqH5dqs+jZ5IVgJJME:Z5+s5yI4IYIII5IqIYIgIHIEIRdI6I6V
TLSH
T136C43B04B7E548A1E9B3963848FED67A073DBE629672CF5BAB147D0C6E33ED01950312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
60ab676b24c0f3fa0406c991352079e510eaa95b5c848aaebeb2a4d563a5ccb3

File Explorer

60ab676b24c0f3fa0406c991352079e510eaa95b5c848aaebeb2a4d563a5ccb3

.dll 530KB

60ab676b24c0f3fa0406c991352079e510eaa95b5c848aaebeb2a4d563a5ccb3

IMPHASH 776fb7ba07f98176e5c26bed1820354d
SHA256 60ab676b24c0f3fa0406c991352079e510eaa95b5c848aaebeb2a4d563a5ccb3
MD5 1282d7d53338c095c9106c1a9dabf7ad
SHA1 47fdf731b7dc7381261d5d64f87e085bb27706ca
SHA512 67a247513c3b6f2dfa83e0fac40d764ffa21fc1149dbea4cce45ec09ff4745226ffa590e662c9bba906a857d6e943785181e60f93624db09a718cbdce395fcc1
SSDEEP 12288:Z5+srJ5yI4IYIII5IqIYIgIHIEIRdI6I6IkrBOpQH+2svfgqH5dqs+jZ5IVgJJME:Z5+s5yI4IYIII5IqIYIgIHIEIRdI6I6V
TLSH
T136C43B04B7E548A1E9B3963848FED67A073DBE629672CF5BAB147D0C6E33ED01950312
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

203920

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls EnumResourceNamesW FindResourceW FindStringOrdinal GetCPInfo GetEnvironmentVariableW GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW IsDBCSLeadByteEx IsValidLocale LoadLibraryW LoadResource MultiByteToWideChar SizeofResource WideCharToMultiByte

ntdll

_vsnprintf

ole32

CLSIDFromProgID CoGetClassObject CoTaskMemFree CreateBindCtx MkParseDisplayName

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantClear VariantCopy VariantCopyInd VariantChangeType SafeArrayCreate SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayUnlock SafeArrayAccessData SafeArrayUnaccessData SafeArrayRedim VarDateFromStr VarFormatDateTime VarFormatNumber VarFormatPercent VarFormatCurrency VarWeekdayName VarMonthName VarAdd VarAnd VarDiv SafeArrayPtrOfIndex VarEqv VarIdiv VarImp VarMod VarMul VarOr VarPow VarSub LoadTypeLib LoadRegTypeLib VarXor VarAbs VarFix VarInt VarNeg VarNot VarCmp SystemTimeToVariantTime VariantTimeToSystemTime VarR8Round VarCat VarDateFromUdateEx

ucrtbase

__acrt_iob_func __stdio_common_vsprintf _assert _dclass _strdup _wcsdup _wcsicmp atan calloc cos exp free fwrite getenv isalnum iswalnum iswalpha iswspace log malloc memcmp memcpy memmove memset pow realloc sin sqrt strchr strcmp strcspn strlen tan towlower towupper wcscmp wcspbrk

user32

LoadStringW MessageBoxW

Name

.text

Size

200KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

229B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

100KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

60ab676b24c0f3fa0406c991352079e510eaa95b5c848aaebeb2a4d563a5ccb3

kernel32

ntdll

ole32

oleaut32

ucrtbase

user32

generic